# CrowdStrike Falcon Integration
Enzoic for Active Directory audit events can be pushed directly to your Crowdstrike Falcon instance. This allows you to leverage the rich search capabilities built into Falcon.
### 2.1 Falcon Configuration
1. From the hamburger menu at the top left, click *Next-Gen SIEM*, then in the flyout, click *Data onboarding*
2. Click the *Data sources* tab.
3. Click *Search by name*, and enter “http” (without quotes).
4. Click on the HEC / HTTP Event data source.
5. Enter the required information to setup the data source as follows
1. For *Data source*, enter enzoic-for-ad-audit-log-data-source
2. Select JSON as the *Data type*
3. For *Connector name*, enter enzoic-for-ad-audit-log-connector
4. In the *Parsers* drop down, search for and select the ***enzoic-enzoicforactivedirectory*** parser.
5. Tick the affirmation checkbox at the bottom, above the Cancel button.
6. Click *Save*
6. Click *Close* on the modal popup.
7. Towards the top right of the page, click the *Generate API Key* button.
8. On the Connection setup modal popup, copy off the API key and API URL values to a save and secure location. You will also need these to configure Enzoic for Active Directory in the next steps.
9. In the Enzoic for Active Directory console, click Settings in the left navigation panel, then click on the Crowdstrike tab page.
1. Enter the API URL and API Key generated by Falcon, tick the Enabled checkbox, then click Update Configuration.
Enzoic for Active Directory is now setup to push all audit events to your Falcon instance.
---
# Agent Instructions: Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter:
```
GET https://docs.enzoic.com/enzoic-for-active-directory/product-usage/logging-and-siem-integration/crowdstrike-falcon-integration.md?ask=
```
The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
